laravel插入查询中的绑定参数

Question

Using Laravel's query builder, I formed a database transaction with the following queries:

DB::transaction(function($map) {

    DB::connection('network')->table('Maps')
                              ->insert([
                                    'Name' => '?',
                                    'Gametype' => '?',
                                    'Author' => '?',
                                    'Enabled' => '?',
                                    'Public' => '?',
                                    'Required' => '?',
                                    'Image' => '?',
                                    'ReleaseDate' => '?',
                                    'ContactInfo' => '?',
                                ], [
                                    $map['name'], 
                                    $map['game'], 
                                    $map['creator'], 
                                    $map['enabled'], 
                                    $map['public'], 
                                    $map['required'], 
                                    $map['image-url'], 
                                    $map['released'], 
                                    $map['contact'],
                                ]); 

    DB::connection('website')->table('panel_logs')
                             ->insert([

                                    'message' => 'Added a new map to '. $map['game'] .' called '. $map['name'] .'.',
                                    'timestamp' => Carbon::now(),
                                    'tag' => 2,
                                    'username' => Auth::user()->username

                                ]);

});

The first query inserts data into a database using query bindings. I have an array called maps containing the data for the insert and I would like to bind on the values however it's not working because it's treating the second array as another insert. In the docs, they didn't provide an example of query binding using the builder. Would it be better just to insert the data without binding? Will this still protect me from SQL injection as I think Laravel uses prepared statements anyway with their builder. I just would like to make sure things don't go horribly wrong.

Answer 1

There are different insert methods on the Connection and query Builder classes.

DB::connection('network') // this is Connection object
   ->table('Maps') // but now it's Query\Builder object

Connection insert takes a query string as 1st param, and bindings as 2nd param, while the other one does the job for you (no need to bind anything manually).

So what you need to do is simply this:

DB::connection('network')->table('Maps')
  ->insert([
        'Name' => $maps['name'],
        'Gametype' => $maps['game'],
        ...
    ]);

Builder will take care of preparing statement and binding its values.

---

Also you need to change the transaction part a bit:

DB::transaction(function($con) use ($map) {